Medium severity6.5NVD Advisory· Published Jan 26, 2023· Updated Jun 17, 2026

CVE-2021-36539

Description

Instructure Canvas LMS didn't properly deny access to locked/unpublished files when the unprivileged user access the DocViewer based file preview URL (canvadoc_session_url).

AI Insight

LLM-synthesized narrative grounded in this CVE's description and references.

Affected products

Instructure/Canvas Learning Management Service
cpe:2.3:a:instructure:canvas_learning_management_service:*:*:*:*:*:*:*:*
Range: <2022-10-15
Instructure/Canvas LMSdescription
Gaukas/instructure-canvas-file-oraclellm-create
Instructure/Canvas LMSllm-fuzzy
osv-coords
pkg:bitnami/canvaslms
Range: < 2022-10-15.0.0

Patches

Vulnerability mechanics

References

github.com/instructure/canvas-lms/issues/1905nvdExploitThird Party Advisory

News mentions

No linked articles in our index yet.

cvss	0.423
epss	0.001
exploit	0.000
kev	0.000
patch	0.000
ransomware	0.000